A governance engine is provided that receives changes identified in dependencies in an enterprise and compares those changes to rule triggers, executing an output of a rule if a trigger is implicated. Related agents may examine the identified changes for new, potentially vulnerable or otherwise disallowed dependencies.